diff --git a/src/hb-ot-color-colr-table.hh b/src/hb-ot-color-colr-table.hh index 3e375c4aa..579366a36 100644 --- a/src/hb-ot-color-colr-table.hh +++ b/src/hb-ot-color-colr-table.hh @@ -775,15 +775,15 @@ struct BaseGlyphV1Record return_trace (out->paint.serialize_subset (c, paint, src_base)); } - bool sanitize (hb_sanitize_context_t *c) const + bool sanitize (hb_sanitize_context_t *c, const void *base) const { TRACE_SANITIZE (this); - return_trace (likely (c->check_struct (this) && paint.sanitize (c, this))); + return_trace (likely (c->check_struct (this) && paint.sanitize (c, base))); } public: HBGlyphID glyphId; /* Glyph ID of reference glyph */ - Offset32To paint; /* Offset (from beginning of BaseGlyphV1Record) to Paint, + Offset32To paint; /* Offset (from beginning of BaseGlyphV1Record array) to Paint, * Typically PaintColrLayers */ public: DEFINE_SIZE_STATIC (6); @@ -809,6 +809,12 @@ struct BaseGlyphV1List : SortedArray32Of return_trace (out->len != 0); } + + bool sanitize (hb_sanitize_context_t *c) const + { + TRACE_SANITIZE (this); + return_trace (SortedArray32Of::sanitize (c, this)); + } }; struct LayerV1List : Array32OfOffset32To diff --git a/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5417934246772736 b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5417934246772736 new file mode 100644 index 000000000..03ba8ebe0 Binary files /dev/null and b/test/fuzzing/fonts/clusterfuzz-testcase-minimized-hb-subset-fuzzer-5417934246772736 differ